[bug 916079] Send HTTP users to /users/login which forces HTTPS.

Only applies if SESSION_COOKIE_SECURE=True